{"id":13515463,"url":"https://github.com/tofuutils/pre-commit-opentofu","last_synced_at":"2025-04-09T07:09:45.554Z","repository":{"id":217572050,"uuid":"744203551","full_name":"tofuutils/pre-commit-opentofu","owner":"tofuutils","description":"pre-commit git hooks to take care of OpenTofu configurations","archived":false,"fork":false,"pushed_at":"2025-03-29T17:51:50.000Z","size":579,"stargazers_count":55,"open_issues_count":0,"forks_count":6,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-04-02T06:07:07.589Z","etag":null,"topics":["hacktoberfest","hacktoberfest2024","hashicorp","hashicorp-terraform","opentofu","terraform","tofu"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"antonbabenko/pre-commit-terraform","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tofuutils.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":".github/CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["kvendingoldo"],"custom":"https://www.paypal.me/kvendingoldo"}},"created_at":"2024-01-16T20:28:59.000Z","updated_at":"2025-03-29T17:51:52.000Z","dependencies_parsed_at":null,"dependency_job_id":"4d13de46-80a2-4303-a80f-e9e56cab4361","html_url":"https://github.com/tofuutils/pre-commit-opentofu","commit_stats":{"total_commits":451,"total_committers":85,"mean_commits":5.305882352941176,"dds":0.753880266075388,"last_synced_commit":"5af24ae7a6d7f043fafc1a5b8387c33f0c521302"},"previous_names":["tofuutils/pre-commit-opentofu"],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tofuutils%2Fpre-commit-opentofu","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tofuutils%2Fpre-commit-opentofu/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tofuutils%2Fpre-commit-opentofu/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tofuutils%2Fpre-commit-opentofu/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tofuutils","download_url":"https://codeload.github.com/tofuutils/pre-commit-opentofu/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247994122,"owners_count":21030050,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest","hacktoberfest2024","hashicorp","hashicorp-terraform","opentofu","terraform","tofu"],"created_at":"2024-08-01T05:01:11.628Z","updated_at":"2025-04-09T07:09:45.533Z","avatar_url":"https://github.com/tofuutils.png","language":"Shell","funding_links":["https://github.com/sponsors/kvendingoldo","https://www.paypal.me/kvendingoldo","https://github.com/sponsors/tofuutils)!"],"categories":["Tools"],"sub_categories":["CI"],"readme":"# Collection of git hooks for OpenTofu to be used with [pre-commit framework](http://pre-commit.com/)\n\n[![Github tag](https://img.shields.io/github/tag/tofuutils/pre-commit-opentofu.svg)](https://github.com/tofuutils/pre-commit-opentofu/releases) ![maintenance status](https://img.shields.io/maintenance/yes/2024.svg) [![Help Contribute to Open Source](https://www.codetriage.com/tofuutils/pre-commit-opentofu/badges/users.svg)](https://www.codetriage.com/tofuutils/pre-commit-opentofu)\n\nWant to contribute? Check [open issues](https://github.com/tofuutils/pre-commit-opentofu/issues?q=label%3A%22good+first+issue%22+is%3Aopen+sort%3Aupdated-desc) and [contributing notes](/.github/CONTRIBUTING.md).\n\n## Sponsors\nIf you are using `pre-commit-opentofu` already or want to support its development and [many other open-source projects](https://github.com/tofuutils), please become a [GitHub Sponsor](https://github.com/sponsors/tofuutils)!\n\n\n## Table of content\n\n* [Table of content](#table-of-content)\n* [How to install](#how-to-install)\n  * [1. Install dependencies](#1-install-dependencies)\n  * [2. Install the pre-commit hook globally](#2-install-the-pre-commit-hook-globally)\n  * [3. Add configs and hooks](#3-add-configs-and-hooks)\n  * [4. Run](#4-run)\n* [Available Hooks](#available-hooks)\n* [Hooks usage notes and examples](#hooks-usage-notes-and-examples)\n  * [Known limitations](#known-limitations)\n  * [All hooks: Usage of environment variables in `--args`](#all-hooks-usage-of-environment-variables-in---args)\n  * [All hooks: Set env vars inside hook at runtime](#all-hooks-set-env-vars-inside-hook-at-runtime)\n  * [All hooks: Disable color output](#all-hooks-disable-color-output)\n  * [checkov (deprecated) and tofu\\_checkov](#checkov-deprecated-and-tofu_checkov)\n  * [infracost\\_breakdown](#infracost_breakdown)\n  * [tofu\\_docs](#tofu_docs)\n  * [tofu\\_docs\\_replace (deprecated)](#tofu_docs_replace-deprecated)\n  * [tofu\\_fmt](#tofu_fmt)\n  * [tofu\\_providers\\_lock](#tofu_providers_lock)\n  * [tofu\\_tflint](#tofu_tflint)\n  * [tofu\\_tfsec (deprecated)](#tofu_tfsec-deprecated)\n  * [tofu\\_trivy](#tofu_trivy)\n  * [tofu\\_validate](#tofu_validate)\n  * [tofu\\_wrapper\\_module\\_for\\_each](#tofu_wrapper_module_for_each)\n  * [terrascan](#terrascan)\n  * [tfupdate](#tfupdate)\n* [Docker Usage](#docker-usage)\n  * [File Permissions](#file-permissions)\n  * [Download OpenTofu modules from private GitHub repositories](#download-tofu-modules-from-private-github-repositories)\n* [Authors](#authors)\n* [License](#license)\n\n## How to install\n\n### 1. Install dependencies\n\n\u003c!-- markdownlint-disable no-inline-html --\u003e\n\n* [`pre-commit`](https://pre-commit.com/#install),\n  \u003csub\u003e\u003csup\u003e[`opentofu`](https://opentofu.org/docs/intro/install/),\n  \u003csub\u003e\u003csup\u003e[`git`](https://git-scm.com/downloads),\n  \u003csub\u003e\u003csup\u003ePOSIX compatible shell,\n  \u003csub\u003e\u003csup\u003eInternet connection (on first run),\n  \u003csub\u003e\u003csup\u003ex86_64 or arm64 compatible operation system,\n  \u003csub\u003e\u003csup\u003eSome hardware where this OS will run,\n  \u003csub\u003e\u003csup\u003eElectricity for hardware and internet connection,\n  \u003csub\u003e\u003csup\u003eSome basic physical laws,\n  \u003csub\u003e\u003csup\u003eHope that it all will work.\n  \u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003c/sup\u003e\u003c/sub\u003e\u003cbr\u003e\u003cbr\u003e\n* [`checkov`](https://github.com/bridgecrewio/checkov) required for `tofu_checkov` hook.\n* [`terraform-docs`](https://github.com/terraform-docs/terraform-docs) required for `tofu_docs` hook.\n* [`terragrunt`](https://terragrunt.gruntwork.io/docs/getting-started/install/) required for `terragrunt_validate` hook.\n* [`terrascan`](https://github.com/tenable/terrascan) required for `terrascan` hook.\n* [`TFLint`](https://github.com/terraform-linters/tflint) required for `tofu_tflint` hook.\n* [`TFSec`](https://github.com/liamg/tfsec) required for `tofu_tfsec` hook.\n* [`Trivy`](https://github.com/aquasecurity/trivy) required for `tofu_trivy` hook.\n* [`infracost`](https://github.com/infracost/infracost) required for `infracost_breakdown` hook.\n* [`jq`](https://github.com/stedolan/jq) required for `tofu_validate` with `--retry-once-with-cleanup` flag, and for `infracost_breakdown` hook.\n* [`tfupdate`](https://github.com/minamijoyo/tfupdate) required for `tfupdate` hook.\n* [`hcledit`](https://github.com/minamijoyo/hcledit) required for `tofu_wrapper_module_for_each` hook.\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eDocker\u003c/b\u003e\u003c/summary\u003e\u003cbr\u003e\n\n**Pull docker image with all hooks**:\n\n```bash\nTAG=latest\ndocker pull tofuutils/pre-commit-opentofu:$TAG\n```\n\nAll available tags [here](https://github.com/tofuutils/pre-commit-opentofu/pkgs/container/pre-commit-opentofu/versions).\n\n**Build from scratch**:\n\n\u003e **Note**: To build image you need to have [`docker buildx`](https://docs.docker.com/build/install-buildx/) enabled as default builder.  \n\u003e Otherwise - provide `TARGETOS` and `TARGETARCH` as additional `--build-arg`'s to `docker build`.\n\nWhen hooks-related `--build-arg`s are not specified, only the latest version of `pre-commit` and `opentofu` will be installed.\n\n```bash\ngit clone git@github.com:tofuutils/pre-commit-opentofu.git\ncd pre-commit-opentofu\n# Install the latest versions of all the tools\ndocker build -t pre-commit-opentofu --build-arg INSTALL_ALL=true .\n```\n\nTo install a specific version of individual tools, define it using `--build-arg` arguments or set it to `latest`:\n\n```bash\ndocker build -t pre-commit-opentofu \\\n    --build-arg PRE_COMMIT_VERSION=latest \\\n    --build-arg TOFU_VERSION=latest \\\n    --build-arg CHECKOV_VERSION=2.0.405 \\\n    --build-arg INFRACOST_VERSION=latest \\\n    --build-arg TERRAFORM_DOCS_VERSION=0.15.0 \\\n    --build-arg TERRAGRUNT_VERSION=latest \\\n    --build-arg TERRASCAN_VERSION=1.10.0 \\\n    --build-arg TFLINT_VERSION=0.31.0 \\\n    --build-arg TFSEC_VERSION=latest \\\n    --build-arg TRIVY_VERSION=latest \\\n    --build-arg TFUPDATE_VERSION=latest \\\n    --build-arg HCLEDIT_VERSION=latest \\\n    .\n```\n\nSet `-e PRE_COMMIT_COLOR=never` to disable the color output in `pre-commit`.\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eMacOS\u003c/b\u003e\u003c/summary\u003e\u003cbr\u003e\n\n```bash\nbrew install pre-commit terraform-docs tflint tfsec trivy checkov terrascan infracost tfupdate minamijoyo/hcledit/hcledit jq\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eUbuntu 18.04\u003c/b\u003e\u003c/summary\u003e\u003cbr\u003e\n\n```bash\nsudo apt update\nsudo apt install -y unzip software-properties-common\nsudo add-apt-repository ppa:deadsnakes/ppa\nsudo apt install -y python3.7 python3-pip\npython3 -m pip install --upgrade pip\npip3 install --no-cache-dir pre-commit\npython3.7 -m pip install -U checkov\ncurl -L \"$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E -m 1 \"https://.+?-linux-amd64.tar.gz\")\" \u003e terraform-docs.tgz \u0026\u0026 tar -xzf terraform-docs.tgz \u0026\u0026 rm terraform-docs.tgz \u0026\u0026 chmod +x terraform-docs \u0026\u0026 sudo mv terraform-docs /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.zip\")\" \u003e tflint.zip \u0026\u0026 unzip tflint.zip \u0026\u0026 rm tflint.zip \u0026\u0026 sudo mv tflint /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E -m 1 \"https://.+?tfsec-linux-amd64\")\" \u003e tfsec \u0026\u0026 chmod +x tfsec \u0026\u0026 sudo mv tfsec /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | grep -o -E -i -m 1 \"https://.+?/trivy_.+?_Linux-64bit.tar.gz\")\" \u003e trivy.tar.gz \u0026\u0026 tar -xzf trivy.tar.gz trivy \u0026\u0026 rm trivy.tar.gz \u0026\u0026 sudo mv trivy /usr/bin\ncurl -L \"$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E -m 1 \"https://.+?_Linux_x86_64.tar.gz\")\" \u003e terrascan.tar.gz \u0026\u0026 tar -xzf terrascan.tar.gz terrascan \u0026\u0026 rm terrascan.tar.gz \u0026\u0026 sudo mv terrascan /usr/bin/ \u0026\u0026 terrascan init\nsudo apt install -y jq \u0026\u0026 \\\ncurl -L \"$(curl -s https://api.github.com/repos/infracost/infracost/releases/latest | grep -o -E -m 1 \"https://.+?-linux-amd64.tar.gz\")\" \u003e infracost.tgz \u0026\u0026 tar -xzf infracost.tgz \u0026\u0026 rm infracost.tgz \u0026\u0026 sudo mv infracost-linux-amd64 /usr/bin/infracost \u0026\u0026 infracost register\ncurl -L \"$(curl -s https://api.github.com/repos/minamijoyo/tfupdate/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.tar.gz\")\" \u003e tfupdate.tar.gz \u0026\u0026 tar -xzf tfupdate.tar.gz tfupdate \u0026\u0026 rm tfupdate.tar.gz \u0026\u0026 sudo mv tfupdate /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/minamijoyo/hcledit/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.tar.gz\")\" \u003e hcledit.tar.gz \u0026\u0026 tar -xzf hcledit.tar.gz hcledit \u0026\u0026 rm hcledit.tar.gz \u0026\u0026 sudo mv hcledit /usr/bin/\n```\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eUbuntu 20.04\u003c/b\u003e\u003c/summary\u003e\u003cbr\u003e\n\n```bash\nsudo apt update\nsudo apt install -y unzip software-properties-common python3 python3-pip\npython3 -m pip install --upgrade pip\npip3 install --no-cache-dir pre-commit\npip3 install --no-cache-dir checkov\ncurl -L \"$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E -m 1 \"https://.+?-linux-amd64.tar.gz\")\" \u003e terraform-docs.tgz \u0026\u0026 tar -xzf terraform-docs.tgz terraform-docs \u0026\u0026 rm terraform-docs.tgz \u0026\u0026 chmod +x terraform-docs \u0026\u0026 sudo mv terraform-docs /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E -m 1 \"https://.+?_Linux_x86_64.tar.gz\")\" \u003e terrascan.tar.gz \u0026\u0026 tar -xzf terrascan.tar.gz terrascan \u0026\u0026 rm terrascan.tar.gz \u0026\u0026 sudo mv terrascan /usr/bin/ \u0026\u0026 terrascan init\ncurl -L \"$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.zip\")\" \u003e tflint.zip \u0026\u0026 unzip tflint.zip \u0026\u0026 rm tflint.zip \u0026\u0026 sudo mv tflint /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E -m 1 \"https://.+?tfsec-linux-amd64\")\" \u003e tfsec \u0026\u0026 chmod +x tfsec \u0026\u0026 sudo mv tfsec /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | grep -o -E -i -m 1 \"https://.+?/trivy_.+?_Linux-64bit.tar.gz\")\" \u003e trivy.tar.gz \u0026\u0026 tar -xzf trivy.tar.gz trivy \u0026\u0026 rm trivy.tar.gz \u0026\u0026 sudo mv trivy /usr/bin\nsudo apt install -y jq \u0026\u0026 \\\ncurl -L \"$(curl -s https://api.github.com/repos/infracost/infracost/releases/latest | grep -o -E -m 1 \"https://.+?-linux-amd64.tar.gz\")\" \u003e infracost.tgz \u0026\u0026 tar -xzf infracost.tgz \u0026\u0026 rm infracost.tgz \u0026\u0026 sudo mv infracost-linux-amd64 /usr/bin/infracost \u0026\u0026 infracost register\ncurl -L \"$(curl -s https://api.github.com/repos/minamijoyo/tfupdate/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.tar.gz\")\" \u003e tfupdate.tar.gz \u0026\u0026 tar -xzf tfupdate.tar.gz tfupdate \u0026\u0026 rm tfupdate.tar.gz \u0026\u0026 sudo mv tfupdate /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/minamijoyo/hcledit/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.tar.gz\")\" \u003e hcledit.tar.gz \u0026\u0026 tar -xzf hcledit.tar.gz hcledit \u0026\u0026 rm hcledit.tar.gz \u0026\u0026 sudo mv hcledit /usr/bin/\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eUbuntu 22.04\u003c/b\u003e\u003c/summary\u003e\u003cbr\u003e\n\n```bash\nsudo apt update\nsudo apt install -y unzip software-properties-common python3 python3-pip\npython3 -m pip install --upgrade pip\npip3 install --no-cache-dir pre-commit\npip3 install --no-cache-dir checkov\ncurl -L \"$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E -m 1 \"https://.+?-linux-amd64.tar.gz\")\" \u003e terraform-docs.tgz \u0026\u0026 tar -xzf terraform-docs.tgz terraform-docs \u0026\u0026 rm terraform-docs.tgz \u0026\u0026 chmod +x terraform-docs \u0026\u0026 sudo mv terraform-docs /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E -m 1 \"https://.+?_Linux_x86_64.tar.gz\")\" \u003e terrascan.tar.gz \u0026\u0026 tar -xzf terrascan.tar.gz terrascan \u0026\u0026 rm terrascan.tar.gz \u0026\u0026 sudo mv terrascan /usr/bin/ \u0026\u0026 terrascan init\ncurl -L \"$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.zip\")\" \u003e tflint.zip \u0026\u0026 unzip tflint.zip \u0026\u0026 rm tflint.zip \u0026\u0026 sudo mv tflint /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E -m 1 \"https://.+?tfsec-linux-amd64\")\" \u003e tfsec \u0026\u0026 chmod +x tfsec \u0026\u0026 sudo mv tfsec /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | grep -o -E -i -m 1 \"https://.+?/trivy_.+?_Linux-64bit.tar.gz\")\" \u003e trivy.tar.gz \u0026\u0026 tar -xzf trivy.tar.gz trivy \u0026\u0026 rm trivy.tar.gz \u0026\u0026 sudo mv trivy /usr/bin\nsudo apt install -y jq \u0026\u0026 \\\ncurl -L \"$(curl -s https://api.github.com/repos/infracost/infracost/releases/latest | grep -o -E -m 1 \"https://.+?-linux-amd64.tar.gz\")\" \u003e infracost.tgz \u0026\u0026 tar -xzf infracost.tgz \u0026\u0026 rm infracost.tgz \u0026\u0026 sudo mv infracost-linux-amd64 /usr/bin/infracost \u0026\u0026 infracost register\ncurl -L \"$(curl -s https://api.github.com/repos/minamijoyo/tfupdate/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.tar.gz\")\" \u003e tfupdate.tar.gz \u0026\u0026 tar -xzf tfupdate.tar.gz tfupdate \u0026\u0026 rm tfupdate.tar.gz \u0026\u0026 sudo mv tfupdate /usr/bin/\ncurl -L \"$(curl -s https://api.github.com/repos/minamijoyo/hcledit/releases/latest | grep -o -E -m 1 \"https://.+?_linux_amd64.tar.gz\")\" \u003e hcledit.tar.gz \u0026\u0026 tar -xzf hcledit.tar.gz hcledit \u0026\u0026 rm hcledit.tar.gz \u0026\u0026 sudo mv hcledit /usr/bin/\n```\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\u003csummary\u003e\u003cb\u003eWindows 10/11\u003c/b\u003e\u003c/summary\u003e\n\nWe highly recommend using [WSL/WSL2](https://docs.microsoft.com/en-us/windows/wsl/install) with Ubuntu and following the Ubuntu installation guide. Or use Docker.\n\n\u003e **Note**: We won't be able to help with issues that can't be reproduced in Linux/Mac.\n\u003e So, try to find a working solution and send PR before open an issue.\n\nOtherwise, you can follow [this gist](https://gist.github.com/etiennejeanneaurevolve/1ed387dc73c5d4cb53ab313049587d09):\n\n1. Install [`git`](https://git-scm.com/downloads) and [`gitbash`](https://gitforwindows.org/)\n2. Install [Python 3](https://www.python.org/downloads/)\n3. Install all prerequisites needed (see above)\n\nEnsure your PATH environment variable looks for `bash.exe` in `C:\\Program Files\\Git\\bin` (the one present in `C:\\Windows\\System32\\bash.exe` does not work with `pre-commit.exe`)\n\nFor `checkov`, you may need to also set your `PYTHONPATH` environment variable with the path to your Python modules.  \nE.g. `C:\\Users\\USERNAME\\AppData\\Local\\Programs\\Python\\Python39\\Lib\\site-packages`\n\n\u003c/details\u003e\n\n\u003c!-- markdownlint-enable no-inline-html --\u003e\n\n### 2. Install the pre-commit hook globally\n\n\u003e **Note**: not needed if you use the Docker image\n\n```bash\nDIR=~/.git-template\ngit config --global init.templateDir ${DIR}\npre-commit init-templatedir -t pre-commit ${DIR}\n```\n\n### 3. Add configs and hooks\n\nStep into the repository you want to have the pre-commit hooks installed and run:\n\n```bash\ngit init\ncat \u003c\u003cEOF \u003e .pre-commit-config.yaml\nrepos:\n- repo: https://github.com/tofuutils/pre-commit-opentofu\n  rev: \u003cVERSION\u003e # Get the latest from: https://github.com/tofuutils/pre-commit-opentofu/releases\n  hooks:\n    - id: tofu_fmt\n    - id: tofu_docs\nEOF\n```\n\n### 4. Run\n\nExecute this command to run `pre-commit` on all files in the repository (not only changed files):\n\n```bash\npre-commit run -a\n```\n\nOr, using Docker ([available tags](https://github.com/tofuutils/pre-commit-opentofu/pkgs/container/pre-commit-opentofu/versions)):\n\n\u003e **Note**: This command uses your user id and group id for the docker container to use to access the local files.  If the files are owned by another user, update the `USERID` environment variable.  See [File Permissions section](#file-permissions) for more information.\n\n```bash\nTAG=latest\ndocker run -e \"USERID=$(id -u):$(id -g)\" -v $(pwd):/lint -w /lint tofuutils/pre-commit-opentofu:$TAG run -a\n```\n\nExecute this command to list the versions of the tools in Docker:\n\n```bash\nTAG=latest\ndocker run --rm --entrypoint cat tofuutils/pre-commit-opentofu:$TAG /usr/bin/tools_versions_info\n```\n\n## Available Hooks\n\nThere are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (both `*.tf` and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:\n\n\u003c!-- markdownlint-disable no-inline-html --\u003e\n| Hook name                                              | Description                                                                                                                                                                                                                                  | Dependencies\u003cbr\u003e\u003csup\u003e[Install instructions here](#1-install-dependencies)\u003c/sup\u003e      |\n| ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |\n| `checkov` and `tofu_checkov`                      | [checkov](https://github.com/bridgecrewio/checkov) static analysis of OpenTofu templates to spot potential security issues. [Hook notes](#checkov-deprecated-and-tofu_checkov)                                                         | `checkov`\u003cbr\u003eUbuntu deps: `python3`, `python3-pip`                                   |\n| `infracost_breakdown`                                  | Check how much your infra costs with [infracost](https://github.com/infracost/infracost). [Hook notes](#infracost_breakdown)                                                                                                                 | `infracost`, `jq`, [Infracost API key](https://www.infracost.io/docs/#2-get-api-key) |\n| `tofu_docs`                                       | Inserts input and output documentation into `README.md`. Recommended. [Hook notes](#terraform_docs)                                                                                                                                          | `terraform-docs`                                                                     |\n| `tofu_docs_replace`                               | Runs `terraform-docs` and pipes the output directly to README.md. **DEPRECATED**. [Hook notes](#terraform_docs_replace-deprecated)                              | `python3`, `terraform-docs`                                                          |\n| `tofu_docs_without_`\u003cbr\u003e`aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. Hook notes same as for [tofu_docs](#terraform_docs)                                                                                            | `tofu-docs`                                                                     |\n| `tofu_fmt`                                        | Reformat all OpenTofu configuration files to a canonical format. [Hook notes](#terraform_fmt)                                                                                                                                               | -                                                                                    |\n| `tofu_providers_lock`                             | Updates provider signatures in [dependency lock files](https://www.terraform.io/docs/cli/commands/providers/lock.html). [Hook notes](#terraform_providers_lock)                                                                              | -                                                                                    |\n| `tofu_tflint`                                     | Validates all OpenTofu configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Available TFLint rules](https://github.com/terraform-linters/tflint/tree/master/docs/rules#rules). [Hook notes](#terraform_tflint). | `tflint`                                                                             |\n| `tofu_tfsec`                                      | [TFSec](https://github.com/aquasecurity/tfsec) static analysis of terraform templates to spot potential security issues. **DEPRECATED**, use `tofu_trivy`. [Hook notes](#terraform_tfsec-deprecated)                                   | `tfsec`                                                                              |\n| `tofu_trivy`                                      | [Trivy](https://github.com/aquasecurity/trivy) static analysis of terraform templates to spot potential security issues. [Hook notes](#terraform_trivy)                                                                                      | `trivy`                                                                              |\n| `tofu_validate`                                   | Validates all Terraform configuration files. [Hook notes](#tofu_validate)                                                                                                                                                               | `jq`, only for `--retry-once-with-cleanup` flag                                      |\n| `terragrunt_fmt`                                       | Reformat all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format.                                                                                                                   | `terragrunt`                                                                         |\n| `terragrunt_validate`                                  | Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`)                                                                                                                                         | `terragrunt`                                                                         |\n| `tofu_wrapper_module_for_each`                    | Generates OpenTofu wrappers with `for_each` in module. [Hook notes](#terraform_wrapper_module_for_each)                                                                                                                                     | `hcledit`                                                                            |\n| `terrascan`                                            | [terrascan](https://github.com/tenable/terrascan) Detect compliance and security violations. [Hook notes](#terrascan)                                                                                                                        | `terrascan`                                                                          |\n| `tfupdate`                                             | [tfupdate](https://github.com/minamijoyo/tfupdate) Update version constraints of OpenTofu core, providers, and modules. [Hook notes](#tfupdate)                                                                                             | `tfupdate`                                                                           |\n\u003c!-- markdownlint-enable no-inline-html --\u003e\n\nCheck the [source file](https://github.com/tofuutils/pre-commit-opentofu/blob/master/.pre-commit-hooks.yaml) to know arguments used for each hook.\n\n## Hooks usage notes and examples\n\n### Known limitations\n\nOpenTofu operates on a per-dir basis, while `pre-commit` framework only supports files and files that exist. This means if you only remove the TF-related file without any other changes in the same dir, checks will be skipped. Example and details [here](https://github.com/pre-commit/pre-commit/issues/3048).\n\n### All hooks: Usage of environment variables in `--args`\n\n\u003e All, except deprecated hooks: `checkov`, `tofu_docs_replace`\n\nYou can use environment variables for the `--args` section.\n\n\u003e **Warning**: You _must_ use the `${ENV_VAR}` definition, `$ENV_VAR` will not expand.\n\nConfig example:\n\n```yaml\n- id: tofu_tflint\n  args:\n  - --args=--config=${CONFIG_NAME}.${CONFIG_EXT}\n  - --args=--module\n```\n\nIf for config above set up `export CONFIG_NAME=.tflint; export CONFIG_EXT=hcl` before `pre-commit run`, args will be expanded to `--config=.tflint.hcl --module`.\n\n### All hooks: Set env vars inside hook at runtime\n\n\u003e All, except deprecated hooks: `checkov`, `tofu_docs_replace`\n\nYou can specify environment variables that will be passed to the hook at runtime.\n\nConfig example:\n\n```yaml\n- id: tofu_validate\n  args:\n    - --env-vars=AWS_DEFAULT_REGION=\"us-west-2\"\n    - --env-vars=AWS_ACCESS_KEY_ID=\"anaccesskey\"\n    - --env-vars=AWS_SECRET_ACCESS_KEY=\"asecretkey\"\n```\n\n### All hooks: Disable color output\n\n\u003e All, except deprecated hooks: `checkov`, `tofu_docs_replace`\n\nTo disable color output for all hooks, set `PRE_COMMIT_COLOR=never` var. Eg:\n\n```bash\nPRE_COMMIT_COLOR=never pre-commit run\n```\n\n### checkov (deprecated) and tofu_checkov\n\n\u003e `checkov` hook is deprecated, please use `tofu_checkov`.\n\nNote that `tofu_checkov` runs recursively during `-d .` usage. That means, for example, if you change `.tf` file in repo root, all existing `.tf` files in the repo will be checked.\n\n1. You can specify custom arguments. E.g.:\n\n    ```yaml\n    - id: tofu_checkov\n      args:\n        - --args=--quiet\n        - --args=--skip-check CKV2_AWS_8\n    ```\n\n    Check all available arguments [here](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html).\n\nFor deprecated hook you need to specify each argument separately:\n\n```yaml\n- id: checkov\n  args: [\n    \"-d\", \".\",\n    \"--skip-check\", \"CKV2_AWS_8\",\n  ]\n```\n\n2. When you have multiple directories and want to run `tofu_checkov` in all of them and share a single config file - use the `__GIT_WORKING_DIR__` placeholder. It will be replaced by `tofu_checkov` hooks with the Git working directory (repo root) at run time. For example:\n\n    ```yaml\n    - id: tofu_checkov\n      args:\n        - --args=--config-file __GIT_WORKING_DIR__/.checkov.yml\n    ```\n\n### infracost_breakdown\n\n`infracost_breakdown` executes `infracost breakdown` command and compare the estimated costs with those specified in the hook-config. `infracost breakdown` parses OpenTofu HCL code, and calls Infracost Cloud Pricing API (remote version or [self-hosted version](https://www.infracost.io/docs/cloud_pricing_api/self_hosted)).\n\nUnlike most other hooks, this hook triggers once if there are any changed files in the repository.\n\n1. `infracost_breakdown` supports all `infracost breakdown` arguments (run `infracost breakdown --help` to see them). The following example only shows costs:\n\n    ```yaml\n    - id: infracost_breakdown\n      args:\n        - --args=--path=./env/dev\n      verbose: true # Always show costs\n    ```\n    \u003c!-- markdownlint-disable-next-line no-inline-html --\u003e\n    \u003cdetails\u003e\u003csummary\u003eOutput\u003c/summary\u003e\n\n    ```bash\n    Running in \"env/dev\"\n\n    Summary: {\n    \"unsupportedResourceCounts\": {\n        \"aws_sns_topic_subscription\": 1\n      }\n    }\n\n    Total Monthly Cost:        86.83 USD\n    Total Monthly Cost (diff): 86.83 USD\n    ```\n    \u003c!-- markdownlint-disable-next-line no-inline-html --\u003e\n    \u003c/details\u003e\n\n2. Note that spaces are not allowed in `--args`, so you need to split it, like this:\n\n    ```yaml\n    - id: infracost_breakdown\n      args:\n        - --args=--path=./env/dev\n        - --args=--terraform-var-file=\"terraform.tfvars\"\n        - --args=--terraform-var-file=\"../terraform.tfvars\"\n    ```\n\n3. (Optionally) Define `cost constraints` the hook should evaluate successfully in order to pass:\n\n    ```yaml\n    - id: infracost_breakdown\n      args:\n        - --args=--path=./env/dev\n        - --hook-config='.totalHourlyCost|tonumber \u003e 0.1'\n        - --hook-config='.totalHourlyCost|tonumber \u003e 1'\n        - --hook-config='.projects[].diff.totalMonthlyCost|tonumber != 10000'\n        - --hook-config='.currency == \"USD\"'\n    ```\n    \u003c!-- markdownlint-disable-next-line no-inline-html --\u003e\n    \u003cdetails\u003e\u003csummary\u003eOutput\u003c/summary\u003e\n\n    ```bash\n    Running in \"env/dev\"\n    Passed: .totalHourlyCost|tonumber \u003e 0.1         0.11894520547945205 \u003e  0.1\n    Failed: .totalHourlyCost|tonumber \u003e 1           0.11894520547945205 \u003e  1\n    Passed: .projects[].diff.totalMonthlyCost|tonumber !=10000              86.83 != 10000\n    Passed: .currency == \"USD\"              \"USD\" == \"USD\"\n\n    Summary: {\n    \"unsupportedResourceCounts\": {\n        \"aws_sns_topic_subscription\": 1\n      }\n    }\n\n    Total Monthly Cost:        86.83 USD\n    Total Monthly Cost (diff): 86.83 USD\n    ```\n    \u003c!-- markdownlint-disable-next-line no-inline-html --\u003e\n    \u003c/details\u003e\n\n    * Only one path per one hook (`- id: infracost_breakdown`) is allowed.\n    * Set `verbose: true` to see cost even when the checks are passed.\n    * Hook uses `jq` to process the cost estimation report returned by `infracost breakdown` command\n    * Expressions defined as `--hook-config` argument should be in a jq-compatible format (e.g. `.totalHourlyCost`, `.totalMonthlyCost`)\n    To study json output produced by `infracost`, run the command `infracost breakdown -p PATH_TO_TF_DIR --format json`, and explore it on [jqplay.org](https://jqplay.org/).\n    * Supported comparison operators: `\u003c`, `\u003c=`, `==`, `!=`, `\u003e=`, `\u003e`.\n    * Most useful paths and checks:\n        * `.totalHourlyCost` (same as `.projects[].breakdown.totalHourlyCost`) - show total hourly infra cost\n        * `.totalMonthlyCost` (same as `.projects[].breakdown.totalMonthlyCost`) - show total monthly infra cost\n        * `.projects[].diff.totalHourlyCost` - show the difference in hourly cost for the existing infra and tf plan\n        * `.projects[].diff.totalMonthlyCost` - show the difference in monthly cost for the existing infra and tf plan\n        * `.diffTotalHourlyCost` (for Infracost version 0.9.12 or newer) or `[.projects[].diff.totalMonthlyCost | select (.!=null) | tonumber] | add` (for Infracost older than 0.9.12)\n\n4. **Docker usage**. In `docker build` or `docker run` command:\n    * You need to provide [Infracost API key](https://www.infracost.io/docs/integrations/environment_variables/#infracost_api_key) via `-e INFRACOST_API_KEY=\u003cyour token\u003e`. By default, it is saved in `~/.config/infracost/credentials.yml`\n    * Set `-e INFRACOST_SKIP_UPDATE_CHECK=true` to [skip the Infracost update check](https://www.infracost.io/docs/integrations/environment_variables/#infracost_skip_update_check) if you use this hook as part of your CI/CD pipeline.\n\n### tofu_docs\n\n1. `tofu_docs` and `tofu_docs_without_aggregate_type_defaults` will insert/update documentation generated by [terraform-docs](https://github.com/terraform-docs/terraform-docs) framed by markers:\n\n    ```txt\n    \u003c!-- BEGINNING OF PRE-COMMIT-OPENTOFU DOCS HOOK --\u003e\n\n    \u003c!-- END OF PRE-COMMIT-OPENTOFU DOCS HOOK --\u003e\n    ```\n\n    if they are present in `README.md`.\n\n2. It is possible to pass additional arguments to shell scripts when using `tofu_docs` and `tofu_docs_without_aggregate_type_defaults`.\n\n3. It is possible to automatically:\n    * create a documentation file\n    * extend existing documentation file by appending markers to the end of the file (see item 1 above)\n    * use different filename for the documentation (default is `README.md`)\n    * use the same insertion markers as `terraform-docs` by default. It will be default in `v2.0`.  \n      To migrate to `terraform-docs` insertion markers, run in repo root:\n\n      ```bash\n      grep -rl 'BEGINNING OF PRE-COMMIT-OPENTOFU DOCS HOOK' . | xargs sed -i 's/BEGINNING OF PRE-COMMIT-OPENTOFU DOCS HOOK/BEGIN_TF_DOCS/g'\n      grep -rl 'END OF PRE-COMMIT-OPENTOFU DOCS HOOK' . | xargs sed -i 's/END OF PRE-COMMIT-OPENTOFU DOCS HOOK/END_TF_DOCS/g'\n      ```\n\n    ```yaml\n    - id: tofu_docs\n      args:\n        - --hook-config=--path-to-file=README.md        # Valid UNIX path. I.e. ../TFDOC.md or docs/README.md etc.\n        - --hook-config=--add-to-existing-file=true     # Boolean. true or false\n        - --hook-config=--create-file-if-not-exist=true # Boolean. true or false\n        - --hook-config=--use-standard-markers=true     # Boolean. Defaults in v1.x to false. Set to true for compatibility with terraform-docs\n    ```\n\n4. You can provide [any configuration available in `tofu-docs`](https://terraform-docs.io/user-guide/configuration/) as an argument to `tofu_doc` hook, for example:\n\n    ```yaml\n    - id: tofu_docs\n      args:\n        - --args=--config=.terraform-docs.yml\n    ```\n\n    \u003e **Warning**: Avoid use `recursive.enabled: true` in config file, that can cause unexpected behavior.\n\n5. If you need some exotic settings, it can be done too. I.e. this one generates HCL files:\n\n    ```yaml\n    - id: tofu_docs\n      args:\n        - tfvars hcl --output-file terraform.tfvars.model .\n    ```\n\n### tofu_docs_replace (deprecated)\n\n**DEPRECATED**. Will be merged in [`tofu_docs`](#tofu_docs).\n\n`tofu_docs_replace` replaces the entire `README.md` rather than doing string replacement between markers. Put your additional documentation at the top of your `main.tf` for it to be pulled in.\n\nTo replicate functionality in `tofu_docs` hook:\n\n1. Create `.terraform-docs.yml` in the repo root with the following content:\n\n    ```yaml\n    formatter: \"markdown\"\n\n    output:\n    file: \"README.md\"\n    mode: replace\n    template: |-\n        {{/** End of file fixer */}}\n    ```\n\n2. Replace `tofu_docs_replace` hook config in `.pre-commit-config.yaml` with:\n\n    ```yaml\n    - id: tofu_docs\n    args:\n        - --args=--config=.terraform-docs.yml\n    ```\n\n### terraftofu_fmtorm_fmt\n\n1. `tofu_fmt` supports custom arguments so you can pass [supported flags](https://www.terraform.io/docs/cli/commands/fmt.html#usage). Eg:\n\n    ```yaml\n     - id: tofu_fmt\n       args:\n         - --args=-no-color\n         - --args=-diff\n         - --args=-write=false\n    ```\n\n### tofu_providers_lock\n\n\u003e **Note**: The hook requires OpenTofu 1.6.0 or later.\n\n\u003e **Note**: The hook can invoke `tofu providers lock` that can be really slow and requires fetching metadata from remote OpenTofu registries - not all of that metadata is currently being cached by OpenTofu.\n\n\u003e \u003cdetails\u003e\u003csummary\u003e\u003cb\u003eNote\u003c/b\u003e: Read this if you used this hook before v1.80.0 | Planned breaking changes in v2.0\u003c/summary\u003e\n\u003e We introduced '--mode' flag for this hook. If you'd like to continue using this hook as before, please:\n\u003e\n\u003e * Specify `--hook-config=--mode=always-regenerate-lockfile` in `args:`\n\u003e * Before `tofu_providers_lock`, add `tofu_validate` hook with `--hook-config=--retry-once-with-cleanup=true`\n\u003e * Move `--tf-init-args=` to `tofu_validate` hook\n\u003e\n\u003e In the end, you should get config like this:\n\u003e\n\u003e ```yaml\n\u003e - id: tofu_validate\n\u003e   args:\n\u003e     - --hook-config=--retry-once-with-cleanup=true\n\u003e     # - --tf-init-args=-upgrade\n\u003e\n\u003e - id: tofu_providers_lock\n\u003e   args:\n\u003e   - --hook-config=--mode=always-regenerate-lockfile\n\u003e ```\n\u003e\n\u003e Why? When v2.x will be introduced - the default mode will be changed, probably, to `only-check-is-current-lockfile-cross-platform`.\n\u003e\n\u003e You can check available modes for hook below.\n\u003e \u003c/details\u003e\n\n\n1. The hook can work in a few different modes: `only-check-is-current-lockfile-cross-platform` with and without [tofu_validate hook](#tofu_validate) and `always-regenerate-lockfile` - only with tofu_validate hook.\n\n    * `only-check-is-current-lockfile-cross-platform` without tofu_validate - only checks that lockfile has all required SHAs for all providers already added to lockfile.\n\n        ```yaml\n        - id: tofu_providers_lock\n          args:\n          - --hook-config=--mode=only-check-is-current-lockfile-cross-platform\n        ```\n\n    * `only-check-is-current-lockfile-cross-platform` with [tofu_validate hook](#tofu_validate) - make up-to-date lockfile by adding/removing providers and only then check that lockfile has all required SHAs.\n\n        \u003e **Note**: Next `tofu_validate` flag requires additional dependency to be installed: `jq`. Also, it could run another slow and time consuming command - `tofu init`\n\n        ```yaml\n        - id: tofu_validate\n          args:\n            - --hook-config=--retry-once-with-cleanup=true\n\n        - id: tofu_providers_lock\n          args:\n          - --hook-config=--mode=only-check-is-current-lockfile-cross-platform\n        ```\n\n    * `always-regenerate-lockfile` only with [tofu_validate hook](#tofu_validate) - regenerate lockfile from scratch. Can be useful for upgrading providers in lockfile to latest versions\n\n        ```yaml\n        - id: tofu_validate\n          args:\n            - --hook-config=--retry-once-with-cleanup=true\n            - --tf-init-args=-upgrade\n\n        - id: tofu_providers_lock\n          args:\n          - --hook-config=--mode=always-regenerate-lockfile\n        ```\n\n\n3. `tofu_providers_lock` supports custom arguments:\n\n    ```yaml\n     - id: tofu_providers_lock\n       args:\n          - --args=-platform=windows_amd64\n          - --args=-platform=darwin_amd64\n    ```\n\n4. It may happen that OpenTofu working directory (`.terraform`) already exists but not in the best condition (eg, not initialized modules, wrong version of OpenTofu, etc.). To solve this problem, you can find and delete all `.terraform` directories in your repository:\n\n    ```bash\n    echo \"\n    function rm_tofu {\n        find . \\( -iname \".terraform*\" ! -iname \".terraform-docs*\" \\) -print0 | xargs -0 rm -r\n    }\n    \" \u003e\u003e~/.bashrc\n\n    # Reload shell and use `rm_tofu` command in the repo root\n    ```\n\n    `tofu_providers_lock` hook will try to reinitialize directories before running the `tofu providers lock` command.\n\n5. `tofu_providers_lock` support passing custom arguments to its `tofu init`:\n\n    \u003e **Warning** - DEPRECATION NOTICE: This is available only in `no-mode` mode, which will be removed in v2.0. Please provide this keys to [`tofu_validate`](#tofu_validate) hook, which, to take effect, should be called before `tofu_providers_lock`\n\n    ```yaml\n    - id: tofu_providers_lock\n      args:\n        - --tf-init-args=-upgrade\n    ```\n\n\n### tofu_tflint\n\n1. `tofu_tflint` supports custom arguments so you can enable module inspection, enable / disable rules, etc.\n\n    Example:\n\n    ```yaml\n    - id: tofu_tflint\n      args:\n        - --args=--module\n        - --args=--enable-rule=terraform_documented_variables\n    ```\n\n2. When you have multiple directories and want to run `tflint` in all of them and share a single config file, it is impractical to hard-code the path to the `.tflint.hcl` file. The solution is to use the `__GIT_WORKING_DIR__` placeholder which will be replaced by `tofu_tflint` hooks with the Git working directory (repo root) at run time. For example:\n\n    ```yaml\n    - id: tofu_tflint\n      args:\n        - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl\n    ```\n\n3. By default, pre-commit-opentofu performs directory switching into the OpenTofu modules for you. If you want to delgate the directory changing to the binary - this will allow tflint to determine the full paths for error/warning messages, rather than just module relative paths. *Note: this requires `tflint\u003e=0.44.0`.* For example:\n\n    ```yaml\n    - id: tofu_tflint\n          args:\n            - --hook-config=--delegate-chdir\n    ```\n\n\n### tofu_tfsec (deprecated)\n\n**DEPRECATED**. [tfsec was replaced by trivy](https://github.com/aquasecurity/tfsec/discussions/1994), so please use [`tofu_trivy`](#tofu_trivy).\n\n1. `tofu_tfsec` will consume modified files that pre-commit\n    passes to it, so you can perform whitelisting of directories\n    or files to run against via [files](https://pre-commit.com/#config-files)\n    pre-commit flag\n\n    Example:\n\n    ```yaml\n    - id: tofu_tfsec\n      files: ^prd-infra/\n    ```\n\n    The above will tell pre-commit to pass down files from the `prd-infra/` folder\n    only such that the underlying `tfsec` tool can run against changed files in this\n    directory, ignoring any other folders at the root level\n\n2. To ignore specific warnings, follow the convention from the\n[documentation](https://github.com/aquasecurity/tfsec#ignoring-warnings).\n\n    Example:\n\n    ```hcl\n    resource \"aws_security_group_rule\" \"my-rule\" {\n        type = \"ingress\"\n        cidr_blocks = [\"0.0.0.0/0\"] #tfsec:ignore:AWS006\n    }\n    ```\n\n3. `tofu_tfsec` supports custom arguments, so you can pass supported `--no-color` or `--format` (output), `-e` (exclude checks) flags:\n\n    ```yaml\n     - id: tofu_tfsec\n       args:\n         - \u003e\n           --args=--format json\n           --no-color\n           -e aws-s3-enable-bucket-logging,aws-s3-specify-public-access-block\n    ```\n\n4. When you have multiple directories and want to run `tfsec` in all of them and share a single config file - use the `__GIT_WORKING_DIR__` placeholder. It will be replaced by `tofu_tfsec` hooks with Git working directory (repo root) at run time. For example:\n\n    ```yaml\n    - id: tofu_tfsec\n      args:\n        - --args=--config-file=__GIT_WORKING_DIR__/.tfsec.json\n    ```\n\n    Otherwise, will be used files that located in sub-folders:\n\n    ```yaml\n    - id: tofu_tfsec\n      args:\n        - --args=--config-file=.tfsec.json\n    ```\n\n### tofu_trivy\n\n1. `tofu_trivy` will consume modified files that pre-commit\n    passes to it, so you can perform whitelisting of directories\n    or files to run against via [files](https://pre-commit.com/#config-files)\n    pre-commit flag\n\n    Example:\n\n    ```yaml\n    - id: tofu_trivy\n      files: ^prd-infra/\n    ```\n\n    The above will tell pre-commit to pass down files from the `prd-infra/` folder\n    only such that the underlying `trivy` tool can run against changed files in this\n    directory, ignoring any other folders at the root level\n\n2. To ignore specific warnings, follow the convention from the\n[documentation](https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/).\n\n    Example:\n\n    ```hcl\n    #trivy:ignore:AVD-AWS-0107\n    #trivy:ignore:AVD-AWS-0124\n    resource \"aws_security_group_rule\" \"my-rule\" {\n        type = \"ingress\"\n        cidr_blocks = [\"0.0.0.0/0\"]\n    }\n    ```\n\n3. `tofu_trivy` supports custom arguments, so you can pass supported `--format` (output), `--skip-dirs` (exclude directories) and other flags:\n\n    ```yaml\n     - id: tofu_trivy\n       args:\n         - \u003e\n           --args=--format json\n           --skip-dirs=\"**/.terragrunt-cache\"\n    ```\n\n### tofu_validate\n\n1. `tofu_validate` supports custom arguments so you can pass supported `-no-color` or `-json` flags:\n\n    ```yaml\n     - id: tofu_validate\n       args:\n         - --args=-json\n         - --args=-no-color\n    ```\n\n2. `tofu_validate` also supports passing custom arguments to its `tofu init`:\n\n    ```yaml\n    - id: tofu_validate\n      args:\n        - --tf-init-args=-upgrade\n        - --tf-init-args=-lockfile=readonly\n    ```\n\n3. It may happen that OpenTofu working directory (`.terraform`) already exists but not in the best condition (eg, not initialized modules, wrong version of OpenTofu, etc.). To solve this problem, you can delete broken `.terraform` directories in your repository:\n\n    **Option 1**\n\n    ```yaml\n    - id: tofu_validate\n      args:\n        - --hook-config=--retry-once-with-cleanup=true     # Boolean. true or false\n    ```\n\n    \u003e **Note**: The flag requires additional dependency to be installed: `jq`.\n\n    \u003e **Note**: Reinit can be very slow and require downloading data from remote OpenTofu registries, and not all of that downloaded data or meta-data is currently being cached by OpenTofu.\n\n    When `--retry-once-with-cleanup=true`, in each failed directory the cached modules and providers from the `.terraform` directory will be deleted, before retrying once more. To avoid unnecessary deletion of this directory, the cleanup and retry will only happen if OpenTofu produces any of the following error messages:\n\n    * \"Missing or corrupted provider plugins\"\n    * \"Module source has changed\"\n    * \"Module version requirements have changed\"\n    * \"Module not installed\"\n    * \"Could not load plugin\"\n\n    **Warning**: When using `--retry-once-with-cleanup=true`, problematic `.terraform/modules/` and `.terraform/providers/` directories will be recursively deleted without prompting for consent. Other files and directories will not be affected, such as the `.terraform/environment` file.\n\n    **Option 2**\n\n    An alternative solution is to find and delete all `.terraform` directories in your repository:\n\n    ```bash\n    echo \"\n    function rm_tofu {\n        find . \\( -iname \".terraform*\" ! -iname \".terraform-docs*\" \\) -print0 | xargs -0 rm -r\n    }\n    \" \u003e\u003e~/.bashrc\n\n    # Reload shell and use `rm_tofu` command in the repo root\n    ```\n\n   `tofu_validate` hook will try to reinitialize them before running the `tofu validate` command.\n\n    **Warning**: If you use OpenTofu workspaces, DO NOT use this option ([details](https://github.com/tofuutils/pre-commit-opentofu/issues/203#issuecomment-918791847)). Consider the first option, or wait for [`force-init`](https://github.com/tofuutils/pre-commit-opentofu/issues/224) option implementation.\n\n4. `tofu_validate` in a repo with OpenTofu module, written using OpenTofu 1.6.0+ and which uses provider `configuration_aliases` ([Provider Aliases Within Modules](https://www.terraform.io/language/modules/develop/providers#provider-aliases-within-modules)), errors out.\n\n   When running the hook against OpenTofu code where you have provider `configuration_aliases` defined in a `required_providers` configuration block, OpenTofu will throw an error like:\n\n   \u003e Error: Provider configuration not present\n   \u003e To work with `\u003cresource\u003e` its original provider configuration at provider `[\"registry.terraform.io/hashicorp/aws\"].\u003cprovider_alias\u003e` is required, but it has been removed. This occurs when a provider configuration is removed while\n   \u003e objects created by that provider still exist in the state. Re-add the provider configuration to destroy `\u003cresource\u003e`, after which you can remove the provider configuration again.\n\n   This is a [known issue](https://github.com/hashicorp/terraform/issues/28490) with OpenTofu and how providers are initialized in OpenTofu 1.6.0 and later. To work around this you can add an `exclude` parameter to the configuration of `tofu_validate` hook like this:\n\n   ```yaml\n   - id: tofu_validate\n     exclude: '^[^/]+$'\n   ```\n\n   This will exclude the root directory from being processed by this hook. Then add a subdirectory like \"examples\" or \"tests\" and put an example implementation in place that defines the providers with the proper aliases, and this will give you validation of your module through the example. If instead you are using this with multiple modules in one repository you'll want to set the path prefix in the regular expression, such as `exclude: modules/offendingmodule/[^/]+$`.\n\n   Alternately, you can use [terraform-config-inspect](https://github.com/hashicorp/terraform-config-inspect) and use a variant of [this script](https://github.com/bendrucker/terraform-configuration-aliases-action/blob/main/providers.sh) to generate a providers file at runtime:\n\n   ```bash\n   terraform-config-inspect --json . | jq -r '\n     [.required_providers[].aliases]\n     | flatten\n     | del(.[] | select(. == null))\n     | reduce .[] as $entry (\n       {};\n       .provider[$entry.name] //= [] | .provider[$entry.name] += [{\"alias\": $entry.alias}]\n     )\n   ' | tee aliased-providers.tf.json\n   ```\n\n   Save it as `.generate-providers.sh` in the root of your repository and add a `pre-commit` hook to run it before all other hooks, like so:\n\n   ```yaml\n   - repos:\n     - repo: local\n       hooks:\n         - id: generate-tofu-providers\n            name: generate-tofu-providers\n            require_serial: true\n            entry: .generate-providers.sh\n            language: script\n            files: \\.tf(vars)?$\n            pass_filenames: false\n\n     - repo: https://github.com/pre-commit/pre-commit-hooks\n   [...]\n   ```\n\n   \u003e Note: The latter method will leave an \"aliased-providers.tf.json\" file in your repo. You will either want to automate a way to clean this up or add it to your `.gitignore` or both.\n\n### tofu_wrapper_module_for_each\n\n`tofu_wrapper_module_for_each` generates module wrappers for OpenTofu modules (useful for Terragrunt where `for_each` is not supported). When using this hook without arguments it will create wrappers for the root module and all modules available in \"modules\" directory.\n\nYou may want to customize some of the options:\n\n1. `--module-dir=...` - Specify a single directory to process. Values: \".\" (means just root module), \"modules/iam-user\" (a single module), or empty (means include all submodules found in \"modules/*\").\n2. `--module-repo-org=...` - Module repository organization (e.g. \"terraform-aws-modules\").\n3. `--module-repo-shortname=...` - Short name of the repository (e.g. \"s3-bucket\").\n4. `--module-repo-provider=...` - Name of the repository provider (e.g. \"aws\" or \"google\").\n\nSample configuration:\n\n```yaml\n- id: tofu_wrapper_module_for_each\n  args:\n    - --args=--module-dir=.   # Process only root module\n    - --args=--dry-run        # No files will be created/updated\n    - --args=--verbose        # Verbose output\n```\n\n**If you use hook inside Docker:**  \nThe `tofu_wrapper_module_for_each` hook attempts to determine the module's short name to be inserted into the generated `README.md` files for the `source` URLs. Since the container uses a bind mount at a static location, it can cause this short name to be incorrect.  \nIf the generated name is incorrect, set them by providing the `module-repo-shortname` option to the hook:\n\n```yaml\n- id: tofu_wrapper_module_for_each\n  args:\n    - '--args=--module-repo-shortname=ec2-instance'\n```\n\n### terrascan\n\n1. `terrascan` supports custom arguments so you can pass supported flags like `--non-recursive` and `--policy-type` to disable recursive inspection and set the policy type respectively:\n\n    ```yaml\n    - id: terrascan\n      args:\n        - --args=--non-recursive # avoids scan errors on subdirectories without OpenTofu config files\n        - --args=--policy-type=azure\n    ```\n\n    See the `terrascan run -h` command line help for available options.\n\n2. Use the `--args=--verbose` parameter to see the rule ID in the scanning output. Useful to skip validations.\n3. Use `--skip-rules=\"ruleID1,ruleID2\"` parameter to skip one or more rules globally while scanning (e.g.: `--args=--skip-rules=\"ruleID1,ruleID2\"`).\n4. Use the syntax `#ts:skip=RuleID optional_comment` inside a resource to skip the rule for that resource.\n\n### tfupdate\n\n1. Out of the box `tfupdate` will pin the OpenTofu version:\n\n    ```yaml\n    - id: tfupdate\n      name: Autoupdate OpenTofu versions\n    ```\n\n2. If you'd like to pin providers, etc., use custom arguments, i.e `provider=PROVIDER_NAME`:\n\n    ```yaml\n    - id: tfupdate\n      name: Autoupdate AWS provider versions\n      args:\n        - --args=provider aws # Will be pined to latest version\n\n    - id: tfupdate\n      name: Autoupdate Helm provider versions\n      args:\n        - --args=provider helm\n        - --args=--version 2.5.0 # Will be pined to specified version\n    ```\n\nCheck [`tfupdate` usage instructions](https://github.com/minamijoyo/tfupdate#usage) for other available options and usage examples.  \nNo need to pass `--recursive .` as it is added automatically.\n\n## Docker Usage\n\n### File Permissions\n\nA mismatch between the Docker container's user and the local repository file ownership can cause permission issues in the repository where `pre-commit` is run.  The container runs as the `root` user by default, and uses a `tools/entrypoint.sh` script to assume a user ID and group ID if specified by the environment variable `USERID`.\n\nThe [recommended command](#4-run) to run the Docker container is:\n\n```bash\nTAG=latest\ndocker run -e \"USERID=$(id -u):$(id -g)\" -v $(pwd):/lint -w /lint tofuutils/pre-commit-opentofu:$TAG run -a\n```\n\nwhich uses your current session's user ID and group ID to set the variable in the run command.  Without this setting, you may find files and directories owned by `root` in your local repository.\n\nIf the local repository is using a different user or group for permissions, you can modify the `USERID` to the user ID and group ID needed.  **Do not use the username or groupname in the environment variable, as it has no meaning in the container.**  You can get the current directory's owner user ID and group ID from the 3rd (user) and 4th (group) columns in `ls` output:\n\n```bash\n$ ls -aldn .\ndrwxr-xr-x 9 1000 1000 4096 Sep  1 16:23 .\n```\n\n### Download OpenTofu modules from private GitHub repositories\n\nIf you use a private Git repository as your OpenTofu module source, you are required to authenticate to GitHub using a [Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token).\n\nWhen running pre-commit on Docker, both locally or on CI, you need to configure the [~/.netrc](https://www.gnu.org/software/inetutils/manual/html_node/The-_002enetrc-file.html) file, which contains login and initialization information used by the auto-login process.\n\nThis can be achieved by firstly creating the `~/.netrc` file including your `GITHUB_PAT` and `GITHUB_SERVER_HOSTNAME`\n\n```bash\n# set GH values (replace with your own values)\nGITHUB_PAT=ghp_bl481aBlabl481aBla\nGITHUB_SERVER_HOSTNAME=github.com\n\n# create .netrc file\necho -e \"machine $GITHUB_SERVER_HOSTNAME\\n\\tlogin $GITHUB_PAT\" \u003e\u003e ~/.netrc\n```\n\nThe `~/.netrc` file will look similar to the following:\n\n```\nmachine github.com\n  login ghp_bl481aBlabl481aBla\n```\n\n\u003e **Note**: The value of `GITHUB_SERVER_HOSTNAME` can also refer to a GitHub Enterprise server (i.e. `github.my-enterprise.com`).\n\nFinally, you can execute `docker run` with an additional volume mount so that the `~/.netrc` is accessible within the container\n\n```bash\n# run pre-commit-opentofu with docker\n# adding volume for .netrc file\n# .netrc needs to be in /root/ dir\ndocker run --rm -e \"USERID=$(id -u):$(id -g)\" -v ~/.netrc:/root/.netrc -v $(pwd):/lint -w /lint tofuutils/pre-commit-opentofu:latest run -a\n```\n\n## Authors\n\nThis repository is managed by [Alexander Sharov](https://github.com/kvendingoldo), [Nikolay Mishin](https://github.com/Nmishin), and [Anastasiia Kozlova](https://github.com/anastasiiakozlova245) with help from these awesome contributors:\n\n\u003c!-- markdownlint-disable no-inline-html --\u003e\n\u003ca href=\"https://github.com/tofuutils/pre-commit-opentofu/graphs/contributors\"\u003e\n  \u003cimg src=\"https://contrib.rocks/image?repo=tofuutils/pre-commit-opentofu\" /\u003e\n\u003c/a\u003e\n\n\n\u003ca href=\"https://star-history.com/#tofuutils/pre-commit-opentofu\u0026Date\"\u003e\n  \u003cpicture\u003e\n    \u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://api.star-history.com/svg?repos=tofuutils/pre-commit-opentofu\u0026type=Date\u0026theme=dark\" /\u003e\n    \u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://api.star-history.com/svg?repos=tofuutils/pre-commit-opentofu\u0026type=Date\" /\u003e\n    \u003cimg alt=\"Star History Chart\" src=\"https://api.star-history.com/svg?repos=tofuutils/pre-commit-opentofu\u0026type=Date\" /\u003e\n  \u003c/picture\u003e\n\u003c/a\u003e\n\n\u003c!-- markdownlint-enable no-inline-html --\u003e\n\n## License\n\nMIT licensed. See [LICENSE](LICENSE) for full details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftofuutils%2Fpre-commit-opentofu","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftofuutils%2Fpre-commit-opentofu","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftofuutils%2Fpre-commit-opentofu/lists"}